[hyperpolymath]

Fix

Remove the second timeout-minutes key from the Julia job in .github/workflows/ci.yml. Retain the explicit 90-minute budget and all existing tests, relevance gates and required context names.

Why a follow-up

#243 was rebased with user approval. Main and the PR branch then advanced concurrently, and #243 was merged as a9fb609 while the correction was being pushed. The push correctly refused to overwrite the remote update. This branch now starts from that exact merged main and contains only this three-line repair; no merged security/frontend/leaf-PD work is reverted or duplicated.

The overlapping settings (90 and 60) are duplicate YAML map keys, not two distinct timeouts. Main's workflow failed before jobs could start: https://github.com/hyperpolymath/MetaManifold-WebUI/actions/runs/39990718300 . This restores a valid workflow rather than waiving CI.

Verification

• Parse all 8 workflow YAML files with YAML 2.8.1 and unique keys enabled: pass.
• bash -n on all 84 embedded Bash steps: pass.
• Governance contract: all 39 assertions pass; all 8 weakening mutations rejected.
• All 4 producer/logger exit-status combinations pass.
• git diff --check: pass.
• No application, lockfile, licensing or generated-file changes.

Local Node: 22.22.3. Julia/R/Agda are not installed locally, so hosted CI must validate the final head. Passing frontend/scanner tests from the preceding security audit are not substitutes for those runtime checks. No claim is made that main or this repair has passed integration yet.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-23T16:55:52.763915Z We couldn’t complete this review. Comment @codex review to try again.	46665dd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: abca9878-c08b-4565-a724-5d4b5de1cf3e

📥 Commits

Reviewing files that changed from the base of the PR and between a9fb609 and 46665dd.

📒 Files selected for processing: 1

• .github/workflows/ci.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Fork governance

Lane	Status	Run
DEED syntax (repo deed)	🟢 conformant	run 39990855934
K9 conformance (L0–L2; L3 not verified)	green (job: success)	same run
Hypatia verdict grid	purple (job: success)	same run

🟣 critical · commit 46665dd56fd4 · run 39990855934

Reporter	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	🟣 critical	45	57	26	0	— no comparable baseline
panic-attack assail	🔴 high	0	6	11	0	— no comparable baseline
pons asinorum	🟡 medium	0	0	1	0	— no comparable baseline
rhodibot (RSR compliance)	🟠 indeterminate	0	0	0	0	— no comparable baseline
panicbot (panic recovery, error handling)	🟠 indeterminate	0	0	0	0	— no comparable baseline
echidnabot (formal verification: proofs/)	🟠 indeterminate	0	0	0	0	— no comparable baseline
seambot (integration health: API routes)	🟠 indeterminate	0	0	0	0	— no comparable baseline
finishingbot (release readiness)	🟠 indeterminate	0	0	0	0	— no comparable baseline
accessibilitybot (WCAG on the React UI)	🟠 indeterminate	0	0	0	0	— no comparable baseline
glambot (presentation quality)	🟠 indeterminate	0	0	0	0	— no comparable baseline
cipherbot	⚪ not applicable	0	0	0	0	— no comparable baseline
sustainabot	⚪ not applicable	0	0	0	0	— no comparable baseline

Hypatia scan: 128 finding(s)

• critical cicd_rules/banned_language_file — frontend/src/views/run/parseFilterYaml.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/encode.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/charts.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/export.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/figure.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/legend.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/figure/types.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/download.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/text.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/timeago.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/utils/text.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useUnsavedGuard.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.test.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useApi.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useAnalysis.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useSSE.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useTabParam.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useNavRefresh.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/hooks/useJobEvents.ts — TypeScript file detected -- banned language
• critical cicd_rules/banned_language_file — frontend/src/about.ts — TypeScript file detected -- banned language
• 108 more; see the structured report in the artifact.

panic-attack assail: 17 finding(s)

• high DynamicCodeExecution — src/pipeline/dada2/context.jl — eval/Meta.parse in src/pipeline/dada2/context.jl
• high DynamicCodeExecution — src/analysis/analysis.jl — eval/Meta.parse in src/analysis/analysis.jl
• high DynamicCodeExecution — src/analysis/differential.jl — eval/Meta.parse in src/analysis/differential.jl
• high DynamicCodeExecution — src/core/provenance.jl — eval/Meta.parse in src/core/provenance.jl
• high DynamicCodeExecution — scripts/check-julia-syntax.jl — eval/Meta.parse in scripts/check-julia-syntax.jl
• high DynamicCodeExecution — test/unit/test_permanova.jl — eval/Meta.parse in test/unit/test_permanova.jl
• medium UnsafeFFI — src/core/memory_probe.jl — 3 ccall/FFI calls in src/core/memory_probe.jl
• medium InputBoundary — src/server/routes/runs.jl — 2 JSON3.read/JSON.parse call(s) with 0 try block(s) in src/server/routes/runs.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/composition.jl — 6 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/composition.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/studies.jl — 4 JSON3.read/JSON.parse call(s) with 2 try block(s) in src/server/routes/studies.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — src/server/routes/analysis.jl — 9 JSON3.read/JSON.parse call(s) with 4 try block(s) in src/server/routes/analysis.jl — these throw on malformed input; wrap in try/catch
• medium UnsafeFFI — install.jl — 1 ccall/FFI calls in install.jl
• medium ProofDrift — test/unit/test_occupancy_grade.jl — 2 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_occupancy_grade.jl
• medium ProofDrift — test/unit/test_evidence.jl — 1 `@test x isa Y` assertion(s) with no value check — type-only tests may substitute for an unwritten formal theorem in test/unit/test_evidence.jl
• medium InputBoundary — bench/advanced_zero_handling/benchmark.jl — 1 JSON3.read/JSON.parse call(s) with 0 try block(s) in bench/advanced_zero_handling/benchmark.jl — these throw on malformed input; wrap in try/catch
• medium InputBoundary — frontend/src/figure/charts.ts — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/figure/charts.ts — JSON.parse throws SyntaxError on malformed input; wrap in try-catch
• medium InputBoundary — frontend/src/components/alphaMetrics.tsx — 1 JSON.parse call(s) with 0 try block(s) in frontend/src/components/alphaMetrics.tsx — JSON.parse throws SyntaxError on malformed input; wrap in try-catch

pons asinorum: 1 finding(s)

• medium unreachable-after-jump — ./frontend/src/components/PublicationTablesPanel.tsx:208 — statement is unreachable after an unconditional jump (T0, HEURISTIC)

rhodibot (RSR compliance): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

panicbot (panic recovery, error handling): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

echidnabot (formal verification: proofs/): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

seambot (integration health: API routes): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

finishingbot (release readiness): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

accessibilitybot (WCAG on the React UI): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

glambot (presentation quality): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

cipherbot: not_applicable — no cryptography is implemented in this repository

• ⚪ not applicable: no cryptography is implemented in this repository

sustainabot: not_applicable — fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

• ⚪ not applicable: fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)

Scope: static findings reported by each row's tool at the named commit. Purple, red, yellow and blue grade the worst finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

🟢 conformant · commit 46665dd56fd4 · run 39990855934 · validator hyperpolymath/standards@c6d78606f392

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	⚪ not applicable	0	0	0	1	— no comparable baseline

K9 live corpus (L0–L2): 1 finding(s) / scope notes

• live corpus — not_applicable: No tracked K9 contracts or routing files.

Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.

[hyperpolymath]

Independent validation of the exact 46665dd archived tree passed: 39/39 governance assertions, 8/8 weakening mutations rejected, 4/4 CI producer/logger cases, 3/3 K9 optional-log cases, all scanner boundaries (including deleted-history shell credentials, Rust redaction, and six AsciiDoc status cases), unique-key parsing of 11 YAML files, bash -n on 84 embedded run blocks, and git diff --check. The equivalent local clone also passed full-history custom shell scanning and real Gitleaks 8.30.1 working-tree/history scans. No local Julia/R result is claimed; hosted run 39990855274 remains authoritative. Separately, post-#243 default-branch Scorecard run 39990720761 succeeded through analysis, SARIF upload, and artifact upload.

[hyperpolymath]

The repair itself is validated, but this commit does not contain the repository-required Signed-off-by: DCO line. I have carried the exact same tree (one CI file, three deletions) to current-main-based, DCO-signed #254 rather than modifying this branch. Please keep this open until #254 has fresh hosted checks; it can then be closed as superseded, or this branch can be amended with a genuine author signoff and #254 closed instead.

[hyperpolymath]

Superseded by merged #254 (90a1aa25c54b138bca099606427964ce94958191). It carries the exact same three-line CI repair with the required DCO signoff. Its fresh checks are fully green, including the complete Julia/R job, occupancy typed peak and disagreement gate, Agda, DEED, independent K9, all secret scanners, CodeQL, Semgrep, and Sonar. Closing this unsigned duplicate without merging.